7c3637c6d519c8903fe8f78f26764d1e4d52db0388705ea1198f896b14f52b1d

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 08:40

Target

0ffddde34c3fd9c9a91f759c9a26f5c0_NEAS.dll
Size

81KB
MD5

0ffddde34c3fd9c9a91f759c9a26f5c0
SHA1

49ff5751ac2731adf0df6a459674a48134c260dc
SHA256

7c3637c6d519c8903fe8f78f26764d1e4d52db0388705ea1198f896b14f52b1d
SHA512

8378061be0ab9d15b544819a791134743d703da127f8aba93da69e4d80b1c707513615541143ebcdc161270cc19eb87de69ca25da9267f51b08a1cbb1d3dc326
SSDEEP

1536:RByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8WC:sv4JKXTx71wnArSsXFpeXq8WC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ffddde34c3fd9c9a91f759c9a26f5c0_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ffddde34c3fd9c9a91f759c9a26f5c0_NEAS.dll,#1
  2⤵
  PID:1532